5 ms·

> flatpak: I really like software distribution done with flatpak, packages are all running in their own namespace, they can't access all the file system, you ca

by eyberg 2y ago

> flatpak: I really like software distribution done with flatpak, packages are all running in their own namespace, they can't access all the file system, you can roll back to a previous version, and do some interesting stuff As of today flatpak still has holes you can drive a truck through.

BadHumans 2y ago
Use flatseal with flatpak. https://github.com/tchx84/Flatseal https://github.com/tchx84/Flatseal
1oooqooq 2y ago
flatpack for isolation is a joke. All the file duplication, none of the security. Not to mention nothing that depends on camera, screen cap, etc will ever get close to working. Just accepting there's no easy solution, and do aparmour+firejail. It's awful user experience, but at least only once per application. Then it is perfect. There should be a distro like qubes but where everything must have either a firejail profile or a hardened systemd unit file (which is the worse designed/documented thing in the universe, taking the place of X11). That would be the ideal world.
- znpy 2y ago
  To be hones I appreciate flatpak for software distribution. Afaik (correct me if I’m wrong) some degree of security is implemented through selinux (i’m on fedora).
  - 1oooqooq 2y ago
    > implemented through selinux Yes, you are technically right, but you are wrong only in the sense that most packs either do not ship with a selinux policy or ship with some just-added-whatever policy. > I appreciate flatpak for software distribution Flatpack is for distributors. Not end users or for the benefit of the end system running them. There are already too much written about this. The lax state of selinux policies is also a result of this focus. PS: you will see my top comment get downvoted by the distributors who enjoy to offload the burden to end users, without offering any counter argument.
- Vilian 2y ago
  "Let's blame flatpak for softwares that don't support it"
  - 1oooqooq 2y ago
    best argument I've heard against my points so far. but still, since the other solutions require the same amount of work for isolation, the only real benefit of flatpak is bundling soon-to-be-outdate dependencies.
burnt-resistor 2y ago
I still don't understand the slapdash approach the desktop Linux crowd took, Qubes is a much better approach. Such unprofessional software engineering pervades FLOSS with the worn and tired "but it's a hobby project" when it's a core dependency necessary for international corporate, government, and military strategic systems. (I also don't understand the lack of appropriate support for critical projects either, but it makes sense because of decline, entitlement, corruption, and greed.) I had to shout and scream at docker early on for container image integrity, but that fell on deaf ears. Heck, Python even threw away GPG to roll their own sketchy setup and Ruby doesn't even care about package integrity or supply chain attacks.
- tucnak 2y ago
  qubes is x86-only that's why people hate it
- Gud 2y ago
  Perhaps it's the "corporate, government and military strategic systems" doing it wrong, if they choose to rely on a hobbyist project? Not the hobbyist publishing their sources?
Melonai 2y ago
Could you link some related Flatpak issues where this happens? I've been under the impression that security under bwrap could be relatively acceptable and mostly the same as running containers (aside from all the portals). I haven't been using Flatpak, but was recently thinking about it.

by eyberg 2y ago

BadHumans 2y ago

Use flatseal with flatpak. https://github.com/tchx84/Flatseal https://github.com/tchx84/Flatseal

1oooqooq 2y ago

flatpack for isolation is a joke. All the file duplication, none of the security. Not to mention nothing that depends on camera, screen cap, etc will ever get close to working. Just accepting there's no easy solution, and do aparmour+firejail. It's awful user experience, but at least only once per application. Then it is perfect. There should be a distro like qubes but where everything must have either a firejail profile or a hardened systemd unit file (which is the worse designed/documented thing in the universe, taking the place of X11). That would be the ideal world.

znpy 2y ago
To be hones I appreciate flatpak for software distribution. Afaik (correct me if I’m wrong) some degree of security is implemented through selinux (i’m on fedora).
- 1oooqooq 2y ago
  > implemented through selinux Yes, you are technically right, but you are wrong only in the sense that most packs either do not ship with a selinux policy or ship with some just-added-whatever policy. > I appreciate flatpak for software distribution Flatpack is for distributors. Not end users or for the benefit of the end system running them. There are already too much written about this. The lax state of selinux policies is also a result of this focus. PS: you will see my top comment get downvoted by the distributors who enjoy to offload the burden to end users, without offering any counter argument.
Vilian 2y ago
"Let's blame flatpak for softwares that don't support it"
- 1oooqooq 2y ago
  best argument I've heard against my points so far. but still, since the other solutions require the same amount of work for isolation, the only real benefit of flatpak is bundling soon-to-be-outdate dependencies.

burnt-resistor 2y ago

I still don't understand the slapdash approach the desktop Linux crowd took, Qubes is a much better approach. Such unprofessional software engineering pervades FLOSS with the worn and tired "but it's a hobby project" when it's a core dependency necessary for international corporate, government, and military strategic systems. (I also don't understand the lack of appropriate support for critical projects either, but it makes sense because of decline, entitlement, corruption, and greed.) I had to shout and scream at docker early on for container image integrity, but that fell on deaf ears. Heck, Python even threw away GPG to roll their own sketchy setup and Ruby doesn't even care about package integrity or supply chain attacks.

tucnak 2y ago
qubes is x86-only that's why people hate it
Gud 2y ago
Perhaps it's the "corporate, government and military strategic systems" doing it wrong, if they choose to rely on a hobbyist project? Not the hobbyist publishing their sources?

Melonai 2y ago

Could you link some related Flatpak issues where this happens? I've been under the impression that security under bwrap could be relatively acceptable and mostly the same as running containers (aside from all the portals). I haven't been using Flatpak, but was recently thinking about it.